The QR code in the PDF: how documents move the attack onto your phone

Our assessment: the QR code changes the device

A QR code is a link that a computer cannot click and a phone can scan. That is the whole trick. The email arrives on a managed computer with filters, logging and a security team. The reader lifts a phone, and the next step happens on a personal device, on mobile data, outside every control on the first one. The Lab’s assessment is that this is a change of device rather than a clever technique, and that it is why PDFs, which are easy to attach and hard to read for a filter, became the container.

An email with no link

In the case IRONSCALES reported in March 2026, the code led to a credential-harvesting page. The address of the recipient was carried in the page address, encoded, so that the login form was already filled in. Nothing was installed on the phone. The trace was the PDF in the mail and a single browser entry for the landing page[S3]. This is a vendor’s account of one case and one product’s detection; it is not a rate.

The figures, and their limits

Kaspersky reported that blocked phishing emails with malicious QR-code links rose steeply between August and November 2025. The company says QR codes sit in email bodies or, "even more commonly," in PDF attachments, without quantifying either[S1]. It is a short snapshot of one vendor’s email protection, and it counts emails, not people or phones.

Barracuda’s 2025 report found that many malicious PDF attachments in its data contained QR codes leading to phishing sites, and more still of the malicious Microsoft documents did. The sample and period are not stated on the page we read[S2]. We use it as direction, not measurement.

People respond to phone-based approaches. In Verizon’s 2026 report, as summarized by Help Net Security, voice and text phishing simulations drew a somewhat higher median click rate than email. The reported increase is relative, and the absolute difference is small and comes from a small sample[S8].

Two more sources add context and a warning. Lookout’s Q3 2025 report, for enterprise devices only, gives phishing click rates for all devices and for iOS and Android separately. The page mixes "click" and "encounter" rates and does not state its sample, so we do not rank platforms on it[S10]. The FBI’s Internet Crime Complaint Center recorded 191,561 phishing and spoofing complaints in 2025, the most of any crime type; they are self-reported and not specific to phones[S11].

A button built to dodge scanners

Zimperium’s researchers reported in January 2025 a text-message campaign that delivered PDFs impersonating the US Postal Service, which was not involved. The PDF had a clickable button made by placing an object over the text instead of using the standard link instruction, which helps it avoid some scanners. It rendered in some viewers and not in others. Zimperium counted a small set of such PDFs and many phishing pages across dozens of countries and said most reached phones by text message, not email [S4][S5]. No exploit was involved; the PDF was a carrier.

The reader that was only an installer

The second route needs a different idea: staging. A first-stage app can be made to do very little, which makes it look harmless. Later it fetches the real payload, often presented as an update.

According to Zscaler’s ThreatLabz, as reported by Cybersecurity News in October 2026, a PDF reader on Google Play with a sizable install count behaved as an installer for a banking trojan, which then requested accessibility and message access and displayed fake login pages[S6]. The reporting is secondary, Zscaler’s original was not read, and install counts are not infections. Google, for its part, reports it identified a very large number of new malicious apps outside its store in 2025, which is the larger pool such installers come from[S9].

When the scan links an account

A third pattern needs no malware. A CISA alert of 24 November 2025, as reported by Bitdefender, warned that attackers do not break the encryption of Signal or WhatsApp. They get the owner to scan a fake code that silently links the account to a device the attacker controls. The suggested check is the list of linked devices in each app[S7]. A QR code inside a PDF or image is a plausible container for it, which the Lab notes as an inference.

What each route leaves behind

The routes leave different amounts. The credential page leaves the least: the PDF, the message and a browser entry. The text-message PDF adds a message thread and, if the owner entered details, nothing further on the phone. The store-app route leaves the most, because an installed app has a name, a source, a date, permissions and a pattern of network use. Account linking shows up in the messaging app’s list of linked devices. An examiner who knows which route is in play knows which records to ask for, and which absences are ordinary.

What this means for examiners

Ask five questions before treating a scan as a finding. Where did the code come from, and is the original message preserved? Did the page ask for credentials, and were they entered? Which apps were installed around the time, and from where? Which accessibility or message permissions were granted, and when? And which accounts show linked devices the owner does not recognize? For owners, the advice in the cited reports is simple: do not scan a code from an unexpected document, type the address you know instead, and review linked devices. If a client has already scanned, change the password from a different device and preserve the phone as it is. Keep the original PDF and the message that carried it, with their dates, since the landing page may be taken down within days and the message may be the only record of where the code came from.

What the Lab is watching

We are watching for an independent measure of how many QR-code phishing attempts reach phones, because every figure above is a vendor’s view of its own customers. We are also watching for a primary Zscaler report on the reader app[S6], which would let us replace a secondary account. Until then, treat each number here as a direction. We will also revisit the brand lures: organizations named in these campaigns are impersonated, not involved, and we will not name them beyond what the original vendor reports state.